All posts
July 2, 20264 min read

Block disposable email signups in one request

Throwaway inboxes are the cheapest way to fake an account. Here are two free ways to stop them: one API call, or a local list you never have to call at all.

Disposable email domains are how fake accounts get made at scale: sign up, grab the confirmation link from a throwaway inbox, abuse the free tier, repeat. ffraud tracks ~207,000 of these domains and gives you two free ways to shut them out.

#Option 1: one API call

curl https://api.ffraud.com/public/email/check \
  -H "Content-Type: application/json" \
  -d '{"email":"[email protected]"}'

No key, no cap. Reject at signup when is_disposable is true. Full field list is on the email docs.

#Option 2: never call the API at all

If you'd rather not add a network hop to your signup path, download the whole list once a day and check it locally. It's a plain text file, one domain per line, MIT licensed:

cron (daily)
curl -s https://raw.githubusercontent.com/FFraud-com/disposable-email-domains/main/disposable-email-domains.txt -o disposable.txt

Found a disposable domain we're missing? Report it at ffraud.com/report and it ships in the next build. The list gets better for everyone.